[Eduard van Valkenburg (eavanvalkenburg)]

Motivation and Context

OpenAPI allowed base URLs can include a path prefix. URL paths are case-sensitive, so path-prefix matching must preserve case while the existing scheme, host, port, and slash-boundary behavior remains unchanged.

No linked issue.

Description

• Compare allowed URL paths without lowercasing them.
• Keep case-insensitive scheme and host matching and effective-port comparison.
• Add validator coverage for matching paths, descendants, case variants, and prefix controls.
• Add GET and POST runner coverage that verifies authentication and request dispatch only occur for matching path case.

Validation:

• cd python && uv run --python 3.12 pytest -q tests/unit/connectors/openapi_plugin/test_server_url_validator.py tests/unit/connectors/openapi_plugin/test_openapi_runner.py tests/unit/connectors/openapi_plugin/test_sk_openapi.py - passed.
• cd python && uv run --python 3.12 pre-commit run -a - passed.
• cd python && uv run --python 3.12 pytest tests/unit - not completed; collection stopped because the local environment does not include optional connector dependencies.

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines and the pre-submission formatting script raises no violations
• All unit tests pass, and I have added new tests where possible
• I didn't break anyone 😄

[Copilot]

🟢 Approval recommended

No active review issues are reported for the change to case-sensitive allowed-base-URL path matching.

No open issues 🎉

What changed in this PR

This PR makes Python OpenAPI allowed-base-URL path matching case-sensitive while preserving existing scheme, host, effective-port, and slash-boundary behavior.

Changes:

• Remove lowercasing from exact-path and path-prefix comparisons.
• Add validator coverage for matching paths, descendants, case mismatches, and prefix boundaries.
• Add GET and POST coverage confirming rejected paths block both authentication and request dispatch.

File	Description
python/​tests/​unit/​connectors/​openapi_plugin/​test_server_url_validator.py	Tests case-sensitive path matching and prefix boundaries.
python/​tests/​unit/​connectors/​openapi_plugin/​test_openapi_runner.py	Tests authentication and dispatch behavior for matching and mismatched path case.
python/​semantic_kernel/​connectors/​openapi_plugin/​server_url_validator.py	Preserves path case during allowed-URL comparisons.

_{Review effort: Balanced}